Create a logs alert :: Kloudfuse Docs

Create a logs alert

Log monitors generate alerts when a specified a specific pattern or condition is detected within log data—when something unusual or potentially problematic happens within the system, based on information recorded in logs.

To create a log alert, complete these tasks:

Start defining a log alert

In the Alerts interface, click (Create New Alert).
In the initial interface for creating alerts, Kloudfuse guides you to select the appropriate alert type.

Choose Log.

The Create Log Alert interface appears.

Pick log metric

Click the initial text field (a) to Search logs.
The log search interface appears.

Examples on how to search:

Equals = Matches exact values for facets.
Not Equals To != Excludes entries where the facet has a specific value.
Greater than > Checks if the first facet’s value is greater than the second facet’s value; for numerical facets.
Less than < Checks if the first facet’s value is less than the second facet’s value; for numerical facets.
Greater than or equal to >= Checks if a numerical facet’s value is greater than or equal to a specified value.
Less than or equal to <= Checks if a numerical facet’s value is less than or equal to a specified value.
NOT ! Negates a search term.
FacetTermsExist == Searches for terms within a facet.
FacetTermsDoNotExist !== Negates FacetTermsExist.
Contains ** Finds logs where a facet value contains the specified text.
Regex =~ Regular expression equals.
Not Regex !~ Regular expression not equals.
StartsWith *~ Search for a log line that starts with a wildcard value.
EndsWith ~* Search for a log line that ends with a wildcard value.

You can also pick the labels from the drop-down, and assign values to them.
As you select search terms, Kloudfuse adds them to the log query.
To remove a search term that you previously selected, click (Delete) icon on that tile.
To remove all search terms that you previously selected, click the (Delete) icon on the right side of the drop-down.
After you pick a log metric, Kloudfuse displays it in the chart.

Work with queries

Make optional changes to filter and configure your log metric search:
In the (Show count of) drop-down, select all logs, all fingerprints, or one of the many prepared labels.
In the (by) drop-down, choose Everything, or one of the many prepared labels.
In the (limit to) drop-down, select either (bottom) or (top), and specify the number of records to show: 2, 5, 10, 15, 25, 30, 50, or 100.
In the (roll up every) drop-down, select time-based grouping: 15 seconds (default), 20 seconds, 30 seconds, 1 minute, or 2 minutes.
To remove a query, click the (Delete) icon that corresponds to this query.

Work with formulas

Add formula

You can combine metrics over facets or labels into formulas, to get additional insights.

To add a formula, click (Add Formula).
The empty formula option appears in interface as line (1), under the query lines.
Type the formula in the text box next to label (1).
To remove a formula, click the (Delete) icon that corresponds to this formula.

Set condition

Define the condition that triggers the alert:
From the first drop-down, select the condition function: Mean, Min, Max, Sum, Count, or Last (default).
From the second drop-down, select the evaluated query ( Query (a), Query (b), and so on) or formula ( Formula (1), Formula (2), and so on).
From the third drop-down, select the comparison operator: above (default), below, equal to, not equal to, above or equal to, or below or equal to.
[Optional] In the text box, specify the unit of measurement.
In the fourth (last) drop-down, specify the time interval: 5 minutes, 10 minutes, 15 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, or 1 day.
Expand the Configure no data and error handling option.

No data
What to do when data is missing.

In the first drop-down, select one of the options: Alerting, No data, or OK (default).

Error handling
What to do when there is an execution error, or a timeout.

In the second drop-down, select one of the options: Alerting, OK, or Error (default).

Add details

In the Folder name drop-down, select one of the folders.

Alternatively, click the (Create new folder) icon.

Then, in the Create Folder dialog, specify Folder name, and click (Create new folder).

In Rule name, specify the name of your rule.
[Optional] In Title, enter the title of your rule.
[Optional] In Runbook URL, enter the location of the runbook that specifies how to handle the alert.
[Optional] Under Desription, specify the purpose of the rule, what conditions it should catch, and so on.
[Optional] Under Custom labels, click (plus), and specify the custom label name, and its value.

To add more custom labels, click (plus), and specify more custom labels.

To remove a custom label, click (Trash) next to it.

[Optional] Under Custom annotations, click (plus), and specify the custom annotation name, and its value.

To add more custom annotations, click (plus), and specify more custom annotations.

To remove a custom annotation, click (Trash) next to it.

Use annotations to show different alerts and their visualizations.

Add contacts

Choose contact points

Choose one or more of the existing contacts from the drop-down, so they can receive the alert.
To remove a contact you previously selected from the alert notification, click (Delete) icon on their tile.
To remove all contacts that you previously selected, click the (Delete) icon on the right side of the drop-down.

Create new contact points

Click (Create New Contact Points).
Kloudfuse opens the Create Contact points interface.

Specify, configure, test, and save new contact points. See Alerts contact points for details.

Create rule

To finalize, click (Create Rule).
Depending on your choice of calculation when you Set condition (, , , , and so on) Kloudfuse generates a Confirm Query Selection dialog.
In the Confirm Query Selection dialog, click
You get a confirmation message.